Analysis Overview
SHA256
92763eb4ab56f29f4f06e66c91bb7d58ed2f7f6c024612578d38cd50f1da800e
Threat Level: Known bad
The file xero.exe.zip was found to be: Known bad.
Malicious Activity Summary
Exelastealer family
Exela Stealer
Grants admin privileges
Modifies Windows Firewall
Clipboard Data
Loads dropped DLL
Reads user/profile data of web browsers
Network Service Discovery
Looks up external IP address via web service
Legitimate hosting services abused for malware hosting/C2
Adds Run key to start application
Enumerates processes with tasklist
Hide Artifacts: Hidden Files and Directories
UPX packed file
Launches sc.exe
Detects Pyinstaller
Permission Groups Discovery: Local Groups
Event Triggered Execution: Netsh Helper DLL
Browser Information Discovery
Unsigned PE
System Network Connections Discovery
System Network Configuration Discovery: Wi-Fi Discovery
Suspicious use of AdjustPrivilegeToken
Collects information from the system
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Runs net.exe
Gathers system information
Views/modifies file attributes
Gathers network information
MITRE ATT&CK
Analysis: static1
Detonation Overview
Reported
2024-10-28 19:51
Signatures
Detects Pyinstaller
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-10-28 19:51
Reported
2024-10-28 19:54
Platform
win7-20240903-en
Max time kernel
120s
Max time network
128s
Command Line
Signatures
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\xero.exe | N/A |
UPX packed file
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 2076 wrote to memory of 2568 | N/A | C:\Users\Admin\AppData\Local\Temp\xero.exe | C:\Users\Admin\AppData\Local\Temp\xero.exe |
| PID 2076 wrote to memory of 2568 | N/A | C:\Users\Admin\AppData\Local\Temp\xero.exe | C:\Users\Admin\AppData\Local\Temp\xero.exe |
| PID 2076 wrote to memory of 2568 | N/A | C:\Users\Admin\AppData\Local\Temp\xero.exe | C:\Users\Admin\AppData\Local\Temp\xero.exe |
Processes
C:\Users\Admin\AppData\Local\Temp\xero.exe
"C:\Users\Admin\AppData\Local\Temp\xero.exe"
C:\Users\Admin\AppData\Local\Temp\xero.exe
"C:\Users\Admin\AppData\Local\Temp\xero.exe"
Network
Files
C:\Users\Admin\AppData\Local\Temp\_MEI20762\python310.dll
| MD5 | fc7bd515b12e537a39dc93a09b3eaad6 |
| SHA1 | 96f5d4b0967372553cb106539c5566bc184f6167 |
| SHA256 | 461e008b7cdf034f99a566671b87849772873a175aefec6ed00732976f5c4164 |
| SHA512 | a8433d5b403f898e4eeebd72fce08ebad066ca60aeb0b70e2ae78377babc2acbbae2ac91ab20f813cce4b1dc58c2ad6b3868f18cc8ac0fe7be2bff020eb73122 |
memory/2568-53-0x000007FEF6860000-0x000007FEF6CCE000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2024-10-28 19:51
Reported
2024-10-28 19:54
Platform
win10v2004-20241007-en
Max time kernel
139s
Max time network
140s
Command Line
Signatures
Exela Stealer
Exelastealer family
Grants admin privileges
Modifies Windows Firewall
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\netsh.exe | N/A |
| N/A | N/A | C:\Windows\system32\netsh.exe | N/A |
Clipboard Data
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\cmd.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
Loads dropped DLL
Reads user/profile data of web browsers
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Exela Update Service = "C:\\Users\\Admin\\AppData\\Local\\ExelaUpdateService\\Exela.exe" | C:\Windows\system32\reg.exe | N/A |
Legitimate hosting services abused for malware hosting/C2
| Description | Indicator | Process | Target |
| N/A | discord.com | N/A | N/A |
| N/A | discord.com | N/A | N/A |
| N/A | discord.com | N/A | N/A |
| N/A | discord.com | N/A | N/A |
| N/A | discord.com | N/A | N/A |
| N/A | discord.com | N/A | N/A |
Looks up external IP address via web service
| Description | Indicator | Process | Target |
| N/A | ip-api.com | N/A | N/A |
Network Service Discovery
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\cmd.exe | N/A |
| N/A | N/A | C:\Windows\system32\ARP.EXE | N/A |
Enumerates processes with tasklist
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\tasklist.exe | N/A |
| N/A | N/A | C:\Windows\system32\tasklist.exe | N/A |
| N/A | N/A | C:\Windows\system32\tasklist.exe | N/A |
| N/A | N/A | C:\Windows\system32\tasklist.exe | N/A |
Hide Artifacts: Hidden Files and Directories
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\cmd.exe | N/A |
UPX packed file
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Launches sc.exe
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\sc.exe | N/A |
Browser Information Discovery
Detects Pyinstaller
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Event Triggered Execution: Netsh Helper DLL
| Description | Indicator | Process | Target |
| Key queried | \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh | C:\Windows\system32\netsh.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh | C:\Windows\system32\netsh.exe | N/A |
| Key queried | \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh | C:\Windows\system32\netsh.exe | N/A |
| Key value enumerated | \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh | C:\Windows\system32\netsh.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh | C:\Windows\system32\netsh.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh | C:\Windows\system32\netsh.exe | N/A |
| Key value enumerated | \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh | C:\Windows\system32\netsh.exe | N/A |
| Key queried | \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh | C:\Windows\system32\netsh.exe | N/A |
| Key value enumerated | \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh | C:\Windows\system32\netsh.exe | N/A |
Permission Groups Discovery: Local Groups
System Network Configuration Discovery: Wi-Fi Discovery
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\cmd.exe | N/A |
| N/A | N/A | C:\Windows\system32\netsh.exe | N/A |
System Network Connections Discovery
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\NETSTAT.EXE | N/A |
Collects information from the system
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
Gathers network information
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\ipconfig.exe | N/A |
| N/A | N/A | C:\Windows\system32\NETSTAT.EXE | N/A |
Gathers system information
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\systeminfo.exe | N/A |
Runs net.exe
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeIncreaseQuotaPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeTakeOwnershipPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeLoadDriverPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSystemProfilePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSystemtimePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeProfSingleProcessPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeIncBasePriorityPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeBackupPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeRestorePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSystemEnvironmentPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeRemoteShutdownPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeUndockPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeManageVolumePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: 33 | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: 34 | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: 35 | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: 36 | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\system32\tasklist.exe | N/A |
| Token: SeIncreaseQuotaPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeTakeOwnershipPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeLoadDriverPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSystemProfilePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSystemtimePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeProfSingleProcessPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeIncBasePriorityPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeBackupPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeRestorePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSystemEnvironmentPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeRemoteShutdownPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeUndockPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeManageVolumePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: 33 | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: 34 | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: 35 | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: 36 | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\system32\tasklist.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\system32\tasklist.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeIncreaseQuotaPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeTakeOwnershipPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeLoadDriverPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSystemProfilePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSystemtimePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeProfSingleProcessPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeIncBasePriorityPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeBackupPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeRestorePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSystemEnvironmentPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeRemoteShutdownPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeUndockPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeManageVolumePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: 33 | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
Suspicious use of WriteProcessMemory
Views/modifies file attributes
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\attrib.exe | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\xero.exe
"C:\Users\Admin\AppData\Local\Temp\xero.exe"
C:\Users\Admin\AppData\Local\Temp\xero.exe
"C:\Users\Admin\AppData\Local\Temp\xero.exe"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "ver"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tasklist"
C:\Windows\System32\Wbem\WMIC.exe
wmic csproduct get uuid
C:\Windows\system32\tasklist.exe
tasklist
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe""
C:\Windows\system32\attrib.exe
attrib +h +s "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "Exela Update Service" /t REG_SZ /d "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe" /f"
C:\Windows\system32\reg.exe
reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "Exela Update Service" /t REG_SZ /d "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe" /f
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tasklist"
C:\Windows\system32\tasklist.exe
tasklist
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell.exe Get-Clipboard"
C:\Windows\system32\cmd.exe
cmd.exe /c chcp
C:\Windows\system32\chcp.com
chcp
C:\Windows\system32\cmd.exe
cmd.exe /c chcp
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe Get-Clipboard
C:\Windows\system32\tasklist.exe
tasklist /FO LIST
C:\Windows\system32\chcp.com
chcp
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config"
C:\Windows\system32\systeminfo.exe
systeminfo
C:\Windows\system32\netsh.exe
netsh wlan show profiles
C:\Windows\system32\HOSTNAME.EXE
hostname
C:\Windows\System32\Wbem\WMIC.exe
wmic logicaldisk get caption,description,providername
C:\Windows\system32\net.exe
net user
C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user
C:\Windows\system32\query.exe
query user
C:\Windows\system32\quser.exe
"C:\Windows\system32\quser.exe"
C:\Windows\system32\net.exe
net localgroup
C:\Windows\system32\net1.exe
C:\Windows\system32\net1 localgroup
C:\Windows\system32\net.exe
net localgroup administrators
C:\Windows\system32\net1.exe
C:\Windows\system32\net1 localgroup administrators
C:\Windows\system32\net.exe
net user guest
C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user guest
C:\Windows\system32\net.exe
net user administrator
C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user administrator
C:\Windows\System32\Wbem\WMIC.exe
wmic startup get caption,command
C:\Windows\system32\tasklist.exe
tasklist /svc
C:\Windows\system32\ipconfig.exe
ipconfig /all
C:\Windows\system32\ROUTE.EXE
route print
C:\Windows\system32\ARP.EXE
arp -a
C:\Windows\system32\NETSTAT.EXE
netstat -ano
C:\Windows\system32\sc.exe
sc query type= service state= all
C:\Windows\system32\netsh.exe
netsh firewall show state
C:\Windows\system32\netsh.exe
netsh firewall show config
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
C:\Windows\System32\Wbem\WMIC.exe
wmic csproduct get uuid
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
C:\Windows\System32\Wbem\WMIC.exe
wmic csproduct get uuid
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 232.168.11.51.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 149.144.22.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| N/A | 127.0.0.1:57484 | tcp | |
| N/A | 127.0.0.1:57491 | tcp | |
| N/A | 127.0.0.1:57496 | tcp | |
| N/A | 127.0.0.1:57498 | tcp | |
| US | 8.8.8.8:53 | ip-api.com | udp |
| US | 208.95.112.1:80 | ip-api.com | tcp |
| US | 8.8.8.8:53 | 1.112.95.208.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 57.169.31.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | discord.com | udp |
| US | 162.159.138.232:443 | discord.com | tcp |
| US | 162.159.138.232:443 | discord.com | tcp |
| US | 8.8.8.8:53 | api.gofile.io | udp |
| US | 8.8.8.8:53 | 232.138.159.162.in-addr.arpa | udp |
| FR | 45.112.123.126:443 | api.gofile.io | tcp |
| US | 8.8.8.8:53 | store1.gofile.io | udp |
| FR | 45.112.123.227:443 | store1.gofile.io | tcp |
| US | 8.8.8.8:53 | 126.123.112.45.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 227.123.112.45.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 154.239.44.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 200.163.202.172.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 171.39.242.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 172.214.232.199.in-addr.arpa | udp |
| US | 8.8.8.8:53 | discord.com | udp |
| US | 162.159.128.233:443 | discord.com | tcp |
| FR | 45.112.123.126:443 | api.gofile.io | tcp |
| US | 8.8.8.8:53 | 233.128.159.162.in-addr.arpa | udp |
| FR | 45.112.123.227:443 | store1.gofile.io | tcp |
| N/A | 127.0.0.1:57722 | tcp | |
| N/A | 127.0.0.1:57724 | tcp | |
| US | 8.8.8.8:53 | 169.144.22.2.in-addr.arpa | udp |
| US | 162.159.128.233:443 | discord.com | tcp |
| US | 8.8.8.8:53 | 66.209.201.84.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 13.227.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | tse1.mm.bing.net | udp |
| US | 150.171.27.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.27.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.27.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.27.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.27.10:443 | tse1.mm.bing.net | tcp |
| US | 8.8.8.8:53 | 58.99.105.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 10.27.171.150.in-addr.arpa | udp |
Files
C:\Users\Admin\AppData\Local\Temp\_MEI7602\python310.dll
| MD5 | fc7bd515b12e537a39dc93a09b3eaad6 |
| SHA1 | 96f5d4b0967372553cb106539c5566bc184f6167 |
| SHA256 | 461e008b7cdf034f99a566671b87849772873a175aefec6ed00732976f5c4164 |
| SHA512 | a8433d5b403f898e4eeebd72fce08ebad066ca60aeb0b70e2ae78377babc2acbbae2ac91ab20f813cce4b1dc58c2ad6b3868f18cc8ac0fe7be2bff020eb73122 |
C:\Users\Admin\AppData\Local\Temp\_MEI7602\VCRUNTIME140.dll
| MD5 | 870fea4e961e2fbd00110d3783e529be |
| SHA1 | a948e65c6f73d7da4ffde4e8533c098a00cc7311 |
| SHA256 | 76fdb83fde238226b5bebaf3392ee562e2cb7ca8d3ef75983bf5f9d6c7119644 |
| SHA512 | 0b636a3cdefa343eb4cb228b391bb657b5b4c20df62889cd1be44c7bee94ffad6ec82dc4db79949edef576bff57867e0d084e0a597bf7bf5c8e4ed1268477e88 |
memory/1936-55-0x00007FFC9E750000-0x00007FFC9EBBE000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\_MEI7602\base_library.zip
| MD5 | 5e2fcf2cc2af9ec275951a05cfec23b6 |
| SHA1 | f6d27e85aa08758b4273d6a8e4f166ab7b219131 |
| SHA256 | 1b2eec43721ac25169ee9874f6c0e5bef73e7fafa06944235380a54039fbc9bf |
| SHA512 | eacd1ef8fb3df739e73d5dd60b482786838b128cf2d16c85a184a6bf74d39dea86a7519ef85617a3e185541556a0dd73e1a0ea49e76c5dcb72fd572f6826bae4 |
C:\Users\Admin\AppData\Local\Temp\_MEI7602\_ctypes.pyd
| MD5 | 4b90108fabdd64577a84313c765a2946 |
| SHA1 | 245f4628683a3e18bb6f0d1c88aa26fb959ed258 |
| SHA256 | e1b634628839a45ab08913463e07b6b6b7fd502396d768f43b21da2875b506a1 |
| SHA512 | 91fa069d7cf61c57faad6355f6fd46d702576c4342460dadcedfdcbc07cd9d84486734f0561fa5e1e01668b384c3c07dd779b332f77d0bb6fbdbb8c0cb5091bc |
C:\Users\Admin\AppData\Local\Temp\_MEI7602\python3.DLL
| MD5 | c17b7a4b853827f538576f4c3521c653 |
| SHA1 | 6115047d02fbbad4ff32afb4ebd439f5d529485a |
| SHA256 | d21e60f3dfbf2bab0cc8a06656721fa3347f026df10297674fc635ebf9559a68 |
| SHA512 | 8e08e702d69df6840781d174c4565e14a28022b40f650fda88d60172be2d4ffd96a3e9426d20718c54072ca0da27e0455cc0394c098b75e062a27559234a3df7 |
C:\Users\Admin\AppData\Local\Temp\_MEI7602\libffi-7.dll
| MD5 | d50ebf567149ead9d88933561cb87d09 |
| SHA1 | 171df40e4187ebbfdf9aa1d76a33f769fb8a35ed |
| SHA256 | 6aa8e12ce7c8ad52dd2e3fabeb38a726447849669c084ea63d8e322a193033af |
| SHA512 | 7bcc9d6d3a097333e1e4b2b23c81ea1b5db7dbdc5d9d62ebaffb0fdfb6cfe86161520ac14dc835d1939be22b9f342531f48da70f765a60b8e2c3d7b9983021de |
memory/1936-84-0x00007FFCB6C30000-0x00007FFCB6C3F000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\_MEI7602\_uuid.pyd
| MD5 | 59cfd9669367517b384922b2485cb6a7 |
| SHA1 | 1bd44298543204d61d4efd2cd3980ad01071360d |
| SHA256 | e02bfad84786560b624efd56df55c88a4ffbd6c7cfc728bf68b6401aa10f849f |
| SHA512 | d0dd041d8493c7c19db01ea8477981148726796ce2ab58d3193064123319bd5b68fd57871d1db0aaa08d07f78ab96a3d343051c33ffd406e96b921248ea32665 |
C:\Users\Admin\AppData\Local\Temp\_MEI7602\_ssl.pyd
| MD5 | 7e9d95ac47a2284706318656b4f711d3 |
| SHA1 | f085104709201c6e64635aeacf1da51599054e55 |
| SHA256 | 38dcb3d0f217785b39c03d4c949dd1e04b70e9eade8a4ad83f026390684059c9 |
| SHA512 | 294a5148d8fcddabd177b776617da7720d9876ac2a1cdf8dd7b9489f0f719600a634346cdfa07da66588de885b0a64d8cccde4d47edbf6305bd2af44ee209118 |
C:\Users\Admin\AppData\Local\Temp\_MEI7602\_sqlite3.pyd
| MD5 | e7d68df8f65fbb0298a45519e2336f32 |
| SHA1 | ad3c84ad7eb75a61f287b1ba9fd2801567e39b6d |
| SHA256 | 2473ebaf52723c3751a12117ebbe974e50ecdaeb40b282a12ba4e6aa98492e79 |
| SHA512 | 626204685e9b95310aba51be4a8abaf3b6e152fa35902f64f837303fc4011a4518ee393047ceb45bf377e9d965d169c92bfbb6673475150e159c59b7857ba03e |
C:\Users\Admin\AppData\Local\Temp\_MEI7602\_socket.pyd
| MD5 | 53e72716073038c1dd1db65bfdb1254c |
| SHA1 | 7bf220a02a3b51aa51300b3a9ea7fa48358ca161 |
| SHA256 | e1fb6927ba2ed014d0ac750af0ee0bb3d49487dd6920848937259606e1e92e1d |
| SHA512 | c10d91b6ec82402b0eb05dc31a4703c999f4988e88204b695e009fae5fdcc61e8a6dc4d2879ecf2babc030224048afd2f256b9e7f5c5b6f28762047813be0941 |
C:\Users\Admin\AppData\Local\Temp\_MEI7602\_queue.pyd
| MD5 | 5c4c43763fb1a796134aa5734905c891 |
| SHA1 | 44a5e1ae4806406a239129d77888bd87d291a410 |
| SHA256 | 4edc80e7d331ba0e9338431d407157181190f995821d1cd24f7a7aa2422ece0c |
| SHA512 | 07bec7e4a85e76cfab2c21776b50ee2bd0454835fcb43b573dee757eca24cbeb4530784bae07de3be90820cee6d72023d9ded395d4f1a4931971db247dc1a71e |
C:\Users\Admin\AppData\Local\Temp\_MEI7602\_overlapped.pyd
| MD5 | 5c1441f6ee11632183a83dac2d22853b |
| SHA1 | eef732ff4bab9ea5c8fffb6a93c47cfc8e64dae2 |
| SHA256 | 104e0b0e0e9fec9eb6438683296feeba298d5f23b02d2080577fc87ffec67acf |
| SHA512 | e41d3433754a8a3d2c572bb7f3902c0d37cba2e6f3307f0e6dfed316a22b11ef7e52a73c30085fa89fcff603e4b76858abe761217c320e38fa2eb95d1777b595 |
C:\Users\Admin\AppData\Local\Temp\_MEI7602\_multiprocessing.pyd
| MD5 | 4fbc5fd5da9da74c04fe0374387b34d3 |
| SHA1 | 1e9c98db0486f98fb7d8eb9fa57a949494b649b5 |
| SHA256 | b2347790c87052623710382d3178887f68a79618d6da5174909f46b169236950 |
| SHA512 | ce87d4512c2ab7c1ad7986e8e1fe790615ae39c7667d234dfc09026ee7e1518b3bfbf7974612811db0c3e5654b35b54e118e23e624bebe027a51d2c8f2a4652a |
C:\Users\Admin\AppData\Local\Temp\_MEI7602\_lzma.pyd
| MD5 | 8edbeeccb6f3dbb09389d99d45db5542 |
| SHA1 | f7e7af2851a5bf22de79a24fe594b5c0435fca8a |
| SHA256 | 90701973be6b23703e495f6a145bae251a7bb066d3c5f398ec42694fd06a069f |
| SHA512 | 2a8bf60f2280b9a947578bd7fd49c3ace8e010a3d4b38e370edb511ea0e125df688bbac369d6a3cec9d285a1fa2ad2dac18a0ef30fda46e49a9440418581e501 |
C:\Users\Admin\AppData\Local\Temp\_MEI7602\_hashlib.pyd
| MD5 | 3b5530f497ff7c127383d0029e680c35 |
| SHA1 | fb5dc554bb9ff49622184cc16883a7567115c7ca |
| SHA256 | 5971fcc9758b7f4a12cde2190a323f35a34ab7f97bd8c39cc8f3335223102573 |
| SHA512 | 12ced7ddb0352f8eca3c3cb7c7c2faaf08e617b2dd278d20008051fb6b564b17c3e9ecfa8b0ffe7674154ad533dfbbf1e802accd5e1aef12ece01368da06e85a |
C:\Users\Admin\AppData\Local\Temp\_MEI7602\_decimal.pyd
| MD5 | 20985dc78dbd1992382354af5ca28988 |
| SHA1 | 385a3e7a7654e5e4c686399f3a72b235e941e311 |
| SHA256 | f3620cac68595b8a8495ab044f19a1c89012f50d2fe571b7a1721485f7ff2e43 |
| SHA512 | 61b8ecd2d12b3f785773b98d4bf4af0eb6eb2c61fbea6effb77ec24b2127e888d0ea5fdd8cc298484e0f770d70c87907048fc382faace8e0ca6b49ab106c89f8 |
C:\Users\Admin\AppData\Local\Temp\_MEI7602\_cffi_backend.cp310-win_amd64.pyd
| MD5 | 641e49ce0c4fa963d347fbf915aabdbe |
| SHA1 | 1351f6c4ac5dcda7e3ffbf3d5e355b4bb864eb10 |
| SHA256 | 1c795df278c7f64be8e6973f8dbf1a625997cb39ae2dcb5bee0ca4c1b90c8906 |
| SHA512 | 766b9adb5143e89d663177c2fb0e951afb84c0a43ec690ae2c477ee0bbe036df6f4161a6012430d42e4913fd5fbe7e49af6d13ac7c62d042a484861fc5a04616 |
C:\Users\Admin\AppData\Local\Temp\_MEI7602\_bz2.pyd
| MD5 | 6250a28b9d0bfefc1254bd78ece7ae9f |
| SHA1 | 4b07c8e18d23c8ae9d92d7b8d39ae20bc447aecd |
| SHA256 | 7d43f7105aa4f856239235c67f61044493ee6f95ddf04533189bf5ea98073f0b |
| SHA512 | 6d0aa5c3f8f5b268b94341dfdd5afbe48f91f9aac143bf59f7f5e8ba6f54205b85ec527c53498ed8860fdff6a8d08e48ec4e1652eeab2d3c89aaaf3a14fcaaa7 |
C:\Users\Admin\AppData\Local\Temp\_MEI7602\_asyncio.pyd
| MD5 | 7d4f9a2b793e021f7e37b8448751ed4e |
| SHA1 | 0ea07b5024501aad5008655cfeae6d96b5da957a |
| SHA256 | 2293c1b6b0b901832a57a1c4dcb1265c9e92d21177195712c30632a7b63227d4 |
| SHA512 | af75452279c308c61c3e222a031a8201e47e8fe44c4e92cb7dab03d56c7e7e3e2a2c589f650c50e0b29e2df175d6f2ff50c8e5e589d17a124bf0a2e0d7886c26 |
C:\Users\Admin\AppData\Local\Temp\_MEI7602\unicodedata.pyd
| MD5 | fed35db31377d515d198e5e446498be2 |
| SHA1 | 62e388d17e17208ea0e881ccd96c75b7b1fbc5f7 |
| SHA256 | af3cdc9a2a1d923be67244429867a3c5c70835249e3573a03b98d08d148fe24b |
| SHA512 | 0985528cb0289086ec895e21a8947e04f732d5660460f2e7fa8668bd441c891438781c808bcea9294f348720e3752c10ea65363371f7e75ea48600d016bab72a |
C:\Users\Admin\AppData\Local\Temp\_MEI7602\sqlite3.dll
| MD5 | 6a3a34c9c67efd6c17d44292e8db8fad |
| SHA1 | 339b1e514d60d8370eaec1e2f2b71cead999f970 |
| SHA256 | 7b0e840165d65f0f5285476467e4c154c4d936613966b84948110a4614b9cad9 |
| SHA512 | 6f2a1b670d28762745f0d3b961a331cbbb0dec244f8798734b911b3a3bc9519c73a3b26f1e1117725f6f1e880e57cadb562a1450659bca1aae353f6b9575d7f5 |
C:\Users\Admin\AppData\Local\Temp\_MEI7602\select.pyd
| MD5 | 3797a47a60b606e25348c67043874fe8 |
| SHA1 | 63a33fedffd52190236a6acd0fc5d9d491e3ac45 |
| SHA256 | 312e9b01d1632840983e8533d1685a64fb87e4538f724a7a59a71b1ba148bbac |
| SHA512 | 3eb7599825b7b21aaab05e420dd16d4a8eaa21652d232f6e4ede213a232b701401556e44df73cfa20ae855d1adc28304b52d42367b74ebd8e96c2e3d9a9b93e2 |
C:\Users\Admin\AppData\Local\Temp\_MEI7602\pyexpat.pyd
| MD5 | 46331749084f98bcfe8631d74c5e038f |
| SHA1 | 5e5510f7a4d03f10d979e0d6a0d2a6f0e53ca347 |
| SHA256 | 21cc4b9ccd69d08d7c1068b1f004ae9454f7ea0a322801860faf0e6f4a24a3df |
| SHA512 | edd39ce2d927fb6700a86db07f4f56cab897ef91a320f3e5ecb542ea1be6888dd27a08008e5fa1df3765b0c82d1046a23c8d59e76d11f4e6449d4d6826879589 |
C:\Users\Admin\AppData\Local\Temp\_MEI7602\libssl-1_1.dll
| MD5 | 6cd33578bc5629930329ca3303f0fae1 |
| SHA1 | f2f8e3248a72f98d27f0cfa0010e32175a18487f |
| SHA256 | 4150ee603ad2da7a6cb6a895cb5bd928e3a99af7e73c604de1fc224e0809fdb0 |
| SHA512 | c236a6ccc8577c85509d378c1ef014621cab6f6f4aa26796ff32d8eec8e98ded2e55d358a7d236594f7a48646dc2a6bf25b42a37aed549440d52873ebca4713e |
C:\Users\Admin\AppData\Local\Temp\_MEI7602\libcrypto-1_1.dll
| MD5 | 86cfc84f8407ab1be6cc64a9702882ef |
| SHA1 | 86f3c502ed64df2a5e10b085103c2ffc9e3a4130 |
| SHA256 | 11b89cc5531b2a6b89fbbb406ebe8fb01f0bf789e672131b0354e10f9e091307 |
| SHA512 | b33f59497127cb1b4c1781693380576187c562563a9e367ce8abc14c97c51053a28af559cdd8bd66181012083e562c8a8771e3d46adeba269a848153a8e9173c |
memory/1936-63-0x00007FFCAE840000-0x00007FFCAE864000-memory.dmp
memory/1936-86-0x00007FFCB2290000-0x00007FFCB22A9000-memory.dmp
memory/1936-88-0x00007FFCB5C40000-0x00007FFCB5C4D000-memory.dmp
memory/1936-90-0x00007FFCAE070000-0x00007FFCAE089000-memory.dmp
memory/1936-94-0x00007FFCADC50000-0x00007FFCADC6F000-memory.dmp
memory/1936-93-0x00007FFCADB80000-0x00007FFCADBAD000-memory.dmp
memory/1936-96-0x00007FFC9DFC0000-0x00007FFC9E131000-memory.dmp
memory/1936-107-0x00007FFCAE840000-0x00007FFCAE864000-memory.dmp
memory/1936-104-0x00007FFC9DC40000-0x00007FFC9DFB5000-memory.dmp
memory/1936-103-0x00007FFCA7570000-0x00007FFCA7628000-memory.dmp
memory/1936-102-0x00007FFC9E750000-0x00007FFC9EBBE000-memory.dmp
memory/1936-98-0x00007FFCA9810000-0x00007FFCA983E000-memory.dmp
memory/1936-108-0x00007FFCAD880000-0x00007FFCAD895000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\_MEI7602\multidict\_multidict.cp310-win_amd64.pyd
| MD5 | 58a0ff76a0d7d3cd86ceb599d247c612 |
| SHA1 | af52bdb9556ef4b9d38cf0f0b9283494daa556a6 |
| SHA256 | 2079d8be068f67fb2ece4fb3f5927c91c1c25edecb9d1c480829eb1cd21d7cc5 |
| SHA512 | e2d4f80cdeba2f5749a4d3de542e09866055d8aee1d308b96cb61bc53f4495c781e9b2559cc6a5f160be96b307539a8b6e06cabeffcc0ddb9ad4107dcacd8a76 |
memory/1936-116-0x00007FFCB2290000-0x00007FFCB22A9000-memory.dmp
memory/1936-115-0x00007FFCAAF40000-0x00007FFCAAF54000-memory.dmp
memory/1936-114-0x00007FFCAC200000-0x00007FFCAC214000-memory.dmp
memory/1936-113-0x00007FFCAE820000-0x00007FFCAE830000-memory.dmp
memory/1936-105-0x000001E7CD630000-0x000001E7CD9A5000-memory.dmp
memory/1936-119-0x00007FFC9D630000-0x00007FFC9D748000-memory.dmp
memory/1936-118-0x00007FFCB5C40000-0x00007FFCB5C4D000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\_MEI7602\yarl\_quoting_c.cp310-win_amd64.pyd
| MD5 | c14493cd3cc9b9b5f850b5fadcbe936e |
| SHA1 | eddb260ff89bfa132a479fdf783c67098011fb85 |
| SHA256 | 1782f3c12b3eb01716fcd59b0cd69c02c2fb888db4377f4d5fe00f07986be8e3 |
| SHA512 | 0a7b85322b8fa566fb3d24b8e4021fb64433be06c3c4dbeb06d9633e4af0a5b76252fb2228de0abd818be5f4a18fffc712c727816632dd8c8585c9a9a7bf0fb6 |
memory/1936-122-0x00007FFC9F750000-0x00007FFC9F772000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\_MEI7602\aiohttp\_helpers.cp310-win_amd64.pyd
| MD5 | 79dbf6677f21a17c9561eb008cc2a987 |
| SHA1 | 096ef929cd31638cdc3ec18883495e5999efd263 |
| SHA256 | bd1638d83bcc69d9cadc1812d5db298f67d1e1b2831cc7783587c0ac7cf9b595 |
| SHA512 | 2d9d8814f0d69b56a7ff1e9bb4207d00f9259113bc8f3e20211341cffeed117829ba9b80d8c0fb9b2da9fc68910a2be039b0fcf1c7bb0de23efee6644d17e164 |
memory/1936-126-0x00007FFCB42A0000-0x00007FFCB42B7000-memory.dmp
memory/1936-125-0x00007FFCADC50000-0x00007FFCADC6F000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\_MEI7602\aiohttp\_http_writer.cp310-win_amd64.pyd
| MD5 | 878a426eb61ebecdba1016400e8fe60d |
| SHA1 | 7ae2f28199cde86ce2cc382d6a1b87b373940d95 |
| SHA256 | 53fc5a5371a69ec8a700dea681654483c2be301f584d9393789cb5a134ba6aa8 |
| SHA512 | d1297868c9400530733538947603e0c73722600c11dc5ce0d7d8371939a7ac840ac0b574b42d9a9a407c3cfbdd938672f73e5da54aa8317eea4053e66fcd6475 |
memory/1936-129-0x00007FFCAE4B0000-0x00007FFCAE4C9000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\_MEI7602\aiohttp\_http_parser.cp310-win_amd64.pyd
| MD5 | 16a2765d0487ee171c8f8761df29ddcf |
| SHA1 | 44fc0c0700039457095256f18702f56ec8ff743e |
| SHA256 | 285d9d527b2f1c70182d3060fee35a95b2c4e8316137f5f4dec806eb64e57af2 |
| SHA512 | f78c29c91eb08de69810a64e6a5025e24c692394b0f242f6e281c7bb59f88194ea22a2e33954c1a40adf00b34dd81164655674e496c552057a19b4780b968a6b |
memory/1936-133-0x00007FFC9DFC0000-0x00007FFC9E131000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\_MEI7602\aiohttp\_websocket.cp310-win_amd64.pyd
| MD5 | 623862193e92582b732fcc4683bfb515 |
| SHA1 | ce0b2201938cb7e7ea18dcdd98d8ccc2fa28ef9d |
| SHA256 | dfd68ae5add1c99e0e31820a676fafdf6a472dcab49362d9970c8a66f4121645 |
| SHA512 | 5b7333af6b6e20aa33cce6561b9673ed590e942d58c48004a7203ff3b33eb6f21541398716b550fa602953c14c80a06da8a439f95bd3f004731ecc5c29e347b9 |
C:\Users\Admin\AppData\Local\Temp\_MEI7602\frozenlist\_frozenlist.cp310-win_amd64.pyd
| MD5 | 6106b4d1eec11d2a71def28d2a2afa46 |
| SHA1 | e10039eff42f88a2cd8dfe11d428c35f6178c6ce |
| SHA256 | 19b144f1bfeb38f5a88da4471d0e9eeefcee979e0d574ecf13a28d06bdf7f1da |
| SHA512 | d08ba0cf57d533ce2df7027158329da66518fb1bf10220d836ce39bdf8bc0436dfc3a649cf937b3b3e2bb9ff0d3c9e964416e9ac965cff4b24bd203067f53d43 |
C:\Users\Admin\AppData\Local\Temp\_MEI7602\cryptography\hazmat\bindings\_rust.pyd
| MD5 | 073606ea92928af7b2863782c0114949 |
| SHA1 | ec7b4dbf415af6a071a6ca3a0d4f4a0cf544515c |
| SHA256 | 9be10e3f170875a5b3e403f29d7241bf64957c01bfcae3504f5576578183610a |
| SHA512 | 5cd48348b475c9de7c2c8d85f36a1f8cf63ee5ee2bde60e2e5a1026f0e877b4c686ad07ab37c8ae37b46b719233b28aa699ce5a2fedd0247c7607da6e519a11e |
memory/1936-146-0x00007FFCAD8F0000-0x00007FFCAD90E000-memory.dmp
memory/1936-145-0x00007FFC9DC40000-0x00007FFC9DFB5000-memory.dmp
memory/1936-143-0x00007FFCA7570000-0x00007FFCA7628000-memory.dmp
memory/1936-142-0x00007FFCAE5D0000-0x00007FFCAE5DA000-memory.dmp
memory/1936-141-0x00007FFCAE490000-0x00007FFCAE4A1000-memory.dmp
memory/1936-148-0x00007FFCAD880000-0x00007FFCAD895000-memory.dmp
memory/1936-149-0x00007FFC9CE80000-0x00007FFC9D621000-memory.dmp
memory/1936-138-0x00007FFCA9810000-0x00007FFCA983E000-memory.dmp
memory/1936-140-0x000001E7CD630000-0x000001E7CD9A5000-memory.dmp
memory/1936-134-0x00007FFCADB30000-0x00007FFCADB7C000-memory.dmp
memory/1936-151-0x00007FFCAD8B0000-0x00007FFCAD8E8000-memory.dmp
C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe
| MD5 | 51a59b84b382c87fb5afb6f793c51af0 |
| SHA1 | 3e1ce55d1c0f5dcff9f72a8d34a9d32a7710f009 |
| SHA256 | 48033a75dbddda6de878f156a02550e5769225b36a4ebb8af70b60c1e2f0044b |
| SHA512 | ac4cf466ac5476f13c28514c1afcb8a97162ddf2f6ae6ec4a77aa8253776759610f67086e27f3d31f2191a752944a813ac7c6f596e1fc251d65d91c7a3116782 |
memory/1936-194-0x00007FFC9D630000-0x00007FFC9D748000-memory.dmp
memory/1936-195-0x00007FFCAE370000-0x00007FFCAE37D000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3e454uha.owt.ps1
| MD5 | d17fe0a3f47be24a6453e9ef58c94641 |
| SHA1 | 6ab83620379fc69f80c0242105ddffd7d98d5d9d |
| SHA256 | 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7 |
| SHA512 | 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82 |
memory/412-207-0x000001C1D3620000-0x000001C1D3642000-memory.dmp
memory/1936-212-0x00007FFC9F750000-0x00007FFC9F772000-memory.dmp
memory/1936-213-0x00007FFCB42A0000-0x00007FFCB42B7000-memory.dmp
memory/1936-214-0x00007FFCAE4B0000-0x00007FFCAE4C9000-memory.dmp
memory/1936-215-0x00007FFCADB30000-0x00007FFCADB7C000-memory.dmp
memory/1936-234-0x00007FFC9DFC0000-0x00007FFC9E131000-memory.dmp
memory/1936-239-0x00007FFCAE820000-0x00007FFCAE830000-memory.dmp
memory/1936-253-0x00007FFC9CE80000-0x00007FFC9D621000-memory.dmp
memory/1936-252-0x00007FFCAE370000-0x00007FFCAE37D000-memory.dmp
memory/1936-245-0x00007FFCAE4B0000-0x00007FFCAE4C9000-memory.dmp
memory/1936-243-0x00007FFC9F750000-0x00007FFC9F772000-memory.dmp
memory/1936-238-0x00007FFCAD880000-0x00007FFCAD895000-memory.dmp
memory/1936-236-0x00007FFCA7570000-0x00007FFCA7628000-memory.dmp
memory/1936-235-0x00007FFCA9810000-0x00007FFCA983E000-memory.dmp
memory/1936-227-0x00007FFCAE840000-0x00007FFCAE864000-memory.dmp
memory/1936-251-0x00007FFCAD8B0000-0x00007FFCAD8E8000-memory.dmp
memory/1936-237-0x00007FFC9DC40000-0x00007FFC9DFB5000-memory.dmp
memory/1936-233-0x00007FFCADC50000-0x00007FFCADC6F000-memory.dmp
memory/1936-226-0x00007FFC9E750000-0x00007FFC9EBBE000-memory.dmp
memory/1936-254-0x00007FFC9E750000-0x00007FFC9EBBE000-memory.dmp
memory/1936-281-0x00007FFC9E750000-0x00007FFC9EBBE000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Desktop\CheckpointDebug.docx
| MD5 | af54edc27c578b9f87f7d51e3bc762e4 |
| SHA1 | 8c8ff2863c50336076339c7935267a7ff84a9f21 |
| SHA256 | 8e291eaa2082c5f922c145deab0de86fb98bad3ec1c2796f3f7df5dcbf9f1ffd |
| SHA512 | 1fe591730bb0b63c6b4638af58313917949ad87f13cc262c9a00b9e03489cc57f37b5478912d0fe6cdd00e3c8da434a443c754e0596c403103faa6a1acc08113 |
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Desktop\RequestFind.xlsx
| MD5 | e3e37d1479142efac15df0c55c3129f6 |
| SHA1 | 098831ee410a19e7ce851ddc182ec41186bf38be |
| SHA256 | 81fe46350977e2586199f47868ebfcb5edb2efb8f0f41c75fe03e74f499562f7 |
| SHA512 | bc45d81aefa4cf6e75899694a29033f73c5f67e87ce150cf0986f2963405aa3662b514f80d299a096112a431daee230f2f2df130e05fa70ef399a43ce1dd883a |
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Desktop\ConvertToSearch.docx
| MD5 | 59c2275d22cb6448908f0813ed53c970 |
| SHA1 | 2735a6578795262a44464f7ac9fbb15482fa119c |
| SHA256 | 4c7500e7b3aebf79b005d731587626a73e3196c4da407fa56f64fe3ab182a4eb |
| SHA512 | afba09501fc8d9b7679390cefabf90cb09cdf6eb0714372144c9f0327680268d335360e049731c0974d227abc5ee4b43ee9a4dcf9ebd6c583dd6fa2d911f3360 |
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Desktop\TraceJoin.xlsx
| MD5 | aa72ee21f0950ca3697d330100e40441 |
| SHA1 | e878ff40ffc7bf59678185746a494c69c4903de3 |
| SHA256 | d8c3e4f5e330e2b6198fb95788dbe5b37e2d14bbf111fd9b1cd897406c810b5c |
| SHA512 | 8479e40361ab05a04df781f8967dd5b5faa7701d30c92783bf7127c873cfa513e7dc99505496708b61acf150c319ff83a5d9e41aa259fa6d289c6b947eb17127 |
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Desktop\SplitSelect.docx
| MD5 | 00876cd2ed26c20cdc83740035e660fa |
| SHA1 | 9e7a630c50701b25e4bafc39ad052c3c157235ab |
| SHA256 | ea6069d7e51e2db297259a73141473ac86cfb35fdfc3749cad744bbf4d4ea586 |
| SHA512 | 865650a50f6618a1bceed768a7fdddf2d41ef922e0cd210a1f5dae934dd7b62a7bc3c391fa47cfce4e2df41ac19953ceca0fbbe16891411266aca0c793e81d7e |
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Desktop\RestoreStop.docx
| MD5 | 5ca68d35ee1a9d02d59658e9908749ea |
| SHA1 | 2217add01cace16c1fbba6073e7720b69d703a28 |
| SHA256 | c46a09802356b88ff44a1afd85da6eea62adafa40677a0bf6f355d382098464f |
| SHA512 | b8a57127c96f0d3c866bd1e69672bcb13c968bdeb804971316c4f88931bfbee9005ffb651e44ca46c83dcc91302b35c47f37f8ae68a3e4f005a194c266555496 |
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Documents\MoveConvert.doc
| MD5 | 80b4521a22b6baf44843de733c63831b |
| SHA1 | 0e646617d93a27b6192ce1a13425ea49a4ec0dfd |
| SHA256 | 84be401834e537105559e1188812512a6ca725d2719fe230743ddcfad07a4271 |
| SHA512 | c028269fa7ce6e3e2160ca9ccc91de571965a5c5135c5496390c7d98f30bf48a81de1578f9976b610e3c8774e4378cbb40cee8cf51e955c0cc0145f020f5b3a3 |
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Documents\JoinConvert.docx
| MD5 | 40b0d30c865040a5597910b466bfecd5 |
| SHA1 | 6200543daf4ea1254e0e3b4c406d99eb44798a55 |
| SHA256 | 34e4ae9228af21797d9dfa5e9a67361db62aeb1410e92f0669f86679da874483 |
| SHA512 | 51d03f9dcad63ed50eb065910875531753fbf8a1c74c4bfe46d2c3f2487f93c3607942de35a86d32ab65fefac0c7fe9050d3318ae08873c34a55021aaca99dca |
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Documents\DebugFormat.docx
| MD5 | b52f0b670e4bc56fb65b3ebfb06fbd05 |
| SHA1 | 05968c3844e68543a3f2b2706cb045b58a75783b |
| SHA256 | fe20f4919d52d7c0ad3524b5bf5656ee859098aea3dc71860ff89a01555f433d |
| SHA512 | 0a6f1cc7c3b1f8044ead30ac9aa1c7ef54cccaea03febe4dc0cc24adf929b0d3fe45360f54e2b00d25b0e931e3bb34818b1b7499e944e77f8cf0dad3069fbbf2 |
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Documents\ClearInstall.docx
| MD5 | e9c8ec8d337dfee2c217a497f9eb1c7e |
| SHA1 | 7ec622263ed05c4c0cf179815711597720ad371d |
| SHA256 | 271d89d3c7b590141e2821ec76ed84b9b062a4c4a44da90158e63a7416c01ed5 |
| SHA512 | e26b02ae441a84f26549033a975fdef54e265cef64e95abc08723f7dc079e895b86471ff89b07ba493e058b0c627e7822ceb89606c1afd2d71aa0d362deb29ae |
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Documents\ResumeComplete.xlsx
| MD5 | eb155e15145bc8a7592ece9f4b7ac971 |
| SHA1 | cee1c6b750f7b079a772c7d8969671da1a5d87f2 |
| SHA256 | 5a91b260e3c8cd13c4ccfb838cdc93b3d4cecb5b107e988527c56d6b947baab8 |
| SHA512 | f86f74f6bfdab8b5c3e53e773b2c3e52e7bad2d0b25f5bb4c663d9251afee4b42384379e539aaaa0bba83d943093bebc9d918b8f1cbfa51ace9dc5e905e6e602 |
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Documents\SkipConvertTo.xls
| MD5 | 5fec35cf8e4db6a7e00be746d949b061 |
| SHA1 | 68a7eb842aee51fd43e0bfb16cd0637de1f3366b |
| SHA256 | e86a9561254d5ffe5841e933b66fbba8029983bb79fda889ae2ae4baec77ebf4 |
| SHA512 | cb457862de8739f3c64bebe485e50eaa3fc6a58259d724cc6032b40e5b6c970c631a2b89b6fbc7b1065e645dd9c80d8acdd3971f121cb9f78cd9b0f69a4d5082 |
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Documents\WaitComplete.xlsx
| MD5 | 93a4109e88878380e209063a314d43a4 |
| SHA1 | fc80c43b906777a509fc09e2a23aa7172fb969b2 |
| SHA256 | a0ae935d7258feb3c8d5fdfcf6eabb561370a05a9127bce39a45f6b7b00c1c28 |
| SHA512 | 4c4c3dfc0a021efd1fdb9e16acf7c77b76cddca4440d972e1360e13375f274451654bdba103001941ba433fbc0f90d928cdf99162b75331205f6018affcd4ab8 |
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Documents\WriteProtect.pdf
| MD5 | a8ddfcee4becccb1d7698fc832b00241 |
| SHA1 | fa6c02153d4a772472f3ba203026831c3f45d9cd |
| SHA256 | bd0bff2182c9b44315fad8a8a770934085af36c1dcd3442a375391f81e96574a |
| SHA512 | 6788258dffe5452b660d7e6fd17aca8d222d6446c7eaa40496d99e8f30119770f2e808559f09a8dcf831521c4358f6755b748fa996b07a77e0a2b955d745ccf8 |
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Downloads\CheckpointRegister.doc
| MD5 | 5e49acf07947256bbd6e2478eef204e4 |
| SHA1 | f907783f2fcc9d1c321f28b0431988f6c1380a82 |
| SHA256 | 371da5e18b8412207bf1c70dbd1dc35a18e608d042781703aa926d2d7d629e85 |
| SHA512 | ed4f5de7c5ac1a83588f9d28a1f914e211353cba45806adda51581b6b19eae7b74f2e1eaabf8be3525a07bc577697547bb5d41a2635459f120b1fe24a39806ba |
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Music\CheckpointTest.docx
| MD5 | cff48d4c287853c1b73545cd78d97ccf |
| SHA1 | d08d1b2df281e7720699a6333583debfefb2215c |
| SHA256 | f88739c7dd7e4b0336735f7745ea6084a176dc132747693d8fd79c55b3145476 |
| SHA512 | e9bade3220f840a616aa349806b24bda5f32c26825c572e7f826a7d5ebc891a5a28223f6f1892382ee9771a5521328263664b140a6a6fea874ccb5437be622d0 |
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Downloads\FormatStep.docx
| MD5 | 461883167899f0f549da07f76effe774 |
| SHA1 | 027421bfeb738fc6eac47c708b3033f3f9523645 |
| SHA256 | 420473eba3f26f8327d32dbcd0c5a3dac57c4f89d6c46da97c295001e38a5b68 |
| SHA512 | 5ad5a3e5d796837e592580a7b66211dfd3af11f57fafa13338d7ab4c48e5ea3055075bab00545e62087fb84a57b5a0baacfba22adad4b960de5a48b58340e852 |
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Pictures\PushSelect.png
| MD5 | aa1f9041b2c39b1498f2008e39f516e4 |
| SHA1 | 105775eb580f6dae7f4301cb419a1548625228f6 |
| SHA256 | 0582f41e5df70c5bd96878e05e45535bd75ac4eceb1f242a1f1ab3961857f9c4 |
| SHA512 | 755bc4eb006a3b9d6dac3a5c0c85ccffc9fa131dcad308624a07e6ffe600005cabc225627c6c254030c72303e2f0dc62eeafd685becd72ffec15ba5365c45d51 |
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Pictures\My Wallpaper.jpg
| MD5 | a51464e41d75b2aa2b00ca31ea2ce7eb |
| SHA1 | 5b94362ac6a23c5aba706e8bfd11a5d8bab6097d |
| SHA256 | 16d5506b6663085b1acd80644ffa5363c158e390da67ed31298b85ddf0ad353f |
| SHA512 | b2a09d52c211e7100e3e68d88c13394c64f23bf2ec3ca25b109ffb1e1a96a054f0e0d25d2f2a0c2145616eabc88c51d63023cef5faa7b49129d020f67ab0b1ff |
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Pictures\FormatRedo.jpeg
| MD5 | 24f88a0361aaba66ab3e813c189b3431 |
| SHA1 | 041e8a7b33ccfe5af4a3cd9706695a2418111dd9 |
| SHA256 | 6437d795f48e4eb694d5d7191fd1d5abffb7438032a987443bb5ccf20c04f9d5 |
| SHA512 | 773e4cf420703173f71bd11d60c3303be00dda4e11b014b318d26c15636e899505bafc78d7c6808493079e36cd0413fae6bc2296bccf1e5dd72b1cc790ef5cde |
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Downloads\CompareBackup.vdx
| MD5 | 1127cfe0928b62690289a585b0f95641 |
| SHA1 | 36fc111ba06e268a5d52421e94e4aad2449dbc18 |
| SHA256 | d663d237dad5f40ed27c48bd27c30975e1b258fccd76e17c2d04efdbdd7c7710 |
| SHA512 | b2bc1d0ac8ec2f93a9398eaf6d9a56ad628a5a48aa0cddd8c47beecb24cf6a000f6df0ab9d394b6578e1ffb2c885ac58d97fc664b1bbeb0c7a46d290533dcfa6 |
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Music\ResizeEnable.xlsx
| MD5 | ab9a1885332ad652a40680c71f7c5cc9 |
| SHA1 | 8d99fe19a3436c09522523ecc117af3cccf306b4 |
| SHA256 | 682f1d7912824f68fdf984acbada9e47014bac45883c0bafe5ffc23858fed2b5 |
| SHA512 | 9952d0a2a8019b2e04e00091ffb390fb317220750d979aabee3496d920dce068be8ff4d9c1bb3817322e9e2076d48d23760ac0fd4149971eb026cda86bda2003 |
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Pictures\ReadInitialize.jpg
| MD5 | f181282e06fb6cd18d9397a925ef0c66 |
| SHA1 | de4bda768a5ef6186264194d266a9a8e23b85d74 |
| SHA256 | 9e31ad38cd036fb53155a359041670b4bde178e17cfa1518c703da33af6e0202 |
| SHA512 | 645976232127a5f2e334e7b5a60b3787679e161c4b8e1114f4fe6d5e47f784cf9703838b8392dc76dc2fe414a665b3d7d96e07c284dfebb63d6d76d2228c438a |
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Pictures\UnlockDebug.jpg
| MD5 | a4ecfee519d23d6f090a12eafaa615f2 |
| SHA1 | 00880bb5cfd97f825fc5e7cd03a357aa6f3f8df4 |
| SHA256 | e31d4941f42e9a7d4ee4955846b23da1691cd1cbbd93fae2ec29e2c095c462e4 |
| SHA512 | b4a91b02370f747ff1b071d910131c738476c72c1d1372c212934d726beca011970f6141ca8c5b7b3aeea36884a779bf8a810286e49346d35b2a03c35b8d1566 |
memory/1936-621-0x00007FFCAE070000-0x00007FFCAE089000-memory.dmp
memory/1936-620-0x00007FFCB5C40000-0x00007FFCB5C4D000-memory.dmp
memory/1936-619-0x00007FFCB2290000-0x00007FFCB22A9000-memory.dmp
memory/1936-618-0x00007FFCB6C30000-0x00007FFCB6C3F000-memory.dmp
memory/1936-617-0x00007FFCAE840000-0x00007FFCAE864000-memory.dmp
memory/1936-616-0x00007FFC9E750000-0x00007FFC9EBBE000-memory.dmp
memory/1936-622-0x00007FFCADB80000-0x00007FFCADBAD000-memory.dmp
memory/1936-633-0x00007FFC9D630000-0x00007FFC9D748000-memory.dmp
memory/1936-636-0x00007FFCAE4B0000-0x00007FFCAE4C9000-memory.dmp
memory/1936-639-0x00007FFCAE5D0000-0x00007FFCAE5DA000-memory.dmp
memory/1936-642-0x00007FFCAE370000-0x00007FFCAE37D000-memory.dmp
memory/1936-641-0x00007FFCAD8B0000-0x00007FFCAD8E8000-memory.dmp
memory/1936-640-0x00007FFC9CE80000-0x00007FFC9D621000-memory.dmp
memory/1936-638-0x00007FFCAE490000-0x00007FFCAE4A1000-memory.dmp
memory/1936-637-0x00007FFCADB30000-0x00007FFCADB7C000-memory.dmp
memory/1936-635-0x00007FFCB42A0000-0x00007FFCB42B7000-memory.dmp
memory/1936-634-0x00007FFC9F750000-0x00007FFC9F772000-memory.dmp
memory/1936-632-0x00007FFCAAF40000-0x00007FFCAAF54000-memory.dmp
memory/1936-631-0x00007FFCAC200000-0x00007FFCAC214000-memory.dmp
memory/1936-630-0x00007FFCAE820000-0x00007FFCAE830000-memory.dmp
memory/1936-629-0x00007FFCAD8F0000-0x00007FFCAD90E000-memory.dmp
memory/1936-628-0x00007FFCAD880000-0x00007FFCAD895000-memory.dmp
memory/1936-627-0x00007FFC9DC40000-0x00007FFC9DFB5000-memory.dmp
memory/1936-626-0x00007FFCA7570000-0x00007FFCA7628000-memory.dmp
memory/1936-625-0x00007FFCA9810000-0x00007FFCA983E000-memory.dmp
memory/1936-624-0x00007FFC9DFC0000-0x00007FFC9E131000-memory.dmp
memory/1936-623-0x00007FFCADC50000-0x00007FFCADC6F000-memory.dmp